[asadowski10]

Summary

Security release. Merging into main triggers release.yml, which builds and pushes the 1.2.1 tag from .plugin-data.

release/1.2.1 was branched from main. It merges the PR branch of #21, which already contains #20, so its tree is identical to develop before the version bump. Companion PR to develop is opened from the same branch.

Content

• Security: allowlist of iframe attributes and http/https-only source, fixing a stored XSS reachable by contributors (fix(security): allowlist iframe attributes and source protocols #21).
• Translations: missing French translations (feat(languages): add missing translations #20).
• Dev dependencies: wpcs 3.4.1 and config.platform.php 8.3.36 to unblock PHP CI (fix(security): allowlist iframe attributes and source protocols #21).

Version bump to 1.2.1

• .plugin-data
• blockparty-iframe.php: header and BLOCKPARTY_IFRAME_VERSION
• package.json / package-lock.json
• src/blockparty-iframe/block.json
• readme.txt: Stable tag and changelog
• .wordpress-org/blueprints/blueprint.json: ref
• languages/blockparty-iframe.pot
• CHANGELOG.md

Test plan

• composer cs: no errors
• npx wp-scripts lint-js src: no errors
• npm run build: compiled, build/blockparty-iframe/block.json reports 1.2.1
• Tag 1.2.1 does not exist yet
• Manual check in wp-env (from fix(security): allowlist iframe attributes and source protocols #21):
  • an onload / srcdoc attribute injected as a contributor does not execute in preview or in the editor;
  • pasting an iframe embed code still works;
  • a 1.1.x post still validates.
• After merge: tag 1.2.1 is created on the merge commit.

---

Generated by Claude Code

---

Note

High Risk
Changes authentication-adjacent content sanitization for iframe markup and URLs; incorrect filtering could break embeds or leave XSS paths open for contributors without unfiltered_html.

Overview
Security release 1.2.1 hardens the iframe block against contributor stored XSS and bumps release metadata so merge to main can tag 1.2.1.

Iframe output is now allowlisted end-to-end. Custom attributes are no longer passed through a deny list; only allow, allowfullscreen, allowpaymentrequest, id, referrerpolicy, sandbox, plus valid aria-* / data-* names are kept in BlockRenderer.php and in editor utils.js / edit.js. Event handlers, srcdoc, and malformed names are dropped. The iframe src must be http or https (esc_url with restricted protocols on the server; isSafeIframeUrl in the editor). Pasting embed HTML now parses via DOMParser instead of injecting into the live DOM, and only allowlisted attrs are extracted.

The deprecated save.js path still uses convertAttributesToRawProps (unfiltered) so legacy serialized markup stays valid without mounting unsafe attrs in the editor preview.

Also adds the missing French string for the source placeholder, bumps wpcs to 3.4.1 and Composer platform.php to 8.3.36, and updates version/changelog/readme/blueprint refs to 1.2.1.

^{Reviewed by Cursor Bugbot for commit bc01291. Bugbot is set up for automated code reviews on this repo. Configure here.}